Abnormality detection method and training method of prediction model for anomaly detection
By training a prediction model containing a bidirectional SE module and an adaptive weighted smoothing loss function, predicting abnormal situations of server sensor data in advance, solving the problem of fault warning delay in the prior art, and improving the advancement and accuracy of fault warning.
Patent Information
- Application Number
- CN202411628811.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-14
- Publication Date
- 2025-02-25
AI Technical Summary
The prior art is difficult to predict failures in server hardware and environment status in advance, resulting in the system triggering alarms only after a failure, which may lead to potential problems for a longer period of time or more serious damage.
By obtaining the historical data of the sensor, a prediction model including a bidirectional SE module and an adaptive weighted smoothing loss function is trained to predict the future trend of the sensor data, and to determine the target abnormality in the predicted data, and issue alarm information in advance.
It has achieved improvement of the advancement and accuracy of fault warnings and reduced the impact of faults on server system operation.
Smart Images
Figure CN119513778A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to an anomaly detection method and a training method for a prediction model for anomaly detection. Background Art
[0002] Servers and other devices are usually equipped with various sensors, which are devices or systems used to monitor and manage the server hardware and environmental status. These sensors usually collect data related to server operating status, environmental conditions, and hardware performance. Server anomaly detection can help maintain server stability and security.
[0003] Traditional sensor systems usually use sensors to continuously monitor various parameter data of the environment or equipment in real time. After the sensor system detects abnormal data collected by the sensor, the system triggers an alarm and notifies maintenance personnel through emails, text messages, instant messages, etc. Among them, the alarm is usually triggered after a fault occurs, which may cause potential problems in the system for a long time or even cause more serious damage.
[0004] Therefore, how to predict in advance the occurrence of failures in devices or systems used to monitor and manage server hardware and environmental status has become a technical problem that needs to be solved urgently. Summary of the invention
[0005] The anomaly detection method and the training method of the prediction model for anomaly detection provided in the embodiments of the present application are used to solve the problems in the prior art regarding how to predict sensor data trends and determine data anomalies, and issue warning information in advance.
[0006] In a first aspect, an embodiment of the present application provides an anomaly detection method, which is applied to a first device, including:
[0007] Acquire first data detected by at least one sensor;
[0008] Inputting the at least one first data into a pre-acquired prediction model to obtain prediction data corresponding to the at least one first data, wherein the prediction model is a model including a bidirectional SE module acquired from the second device, and the adaptive weighted smoothing loss function in the prediction model is an adaptive smoothing loss function with a regularization term added thereto;
[0009] A target abnormality is determined in the prediction data corresponding to the at least one first data.
[0010] In a possible implementation manner, determining a target abnormality in the prediction data corresponding to the at least one first data includes:
[0011] For each type of predicted data corresponding to the first data, when the predicted data is outside a normal value range corresponding to the first data, it is determined that the target abnormal condition is an abnormal condition related to the sensor corresponding to the predicted data.
[0012] In a possible implementation, the method further includes:
[0013] Determine the warning information corresponding to the target abnormal situation, and record the prediction data corresponding to the target abnormal situation.
[0014] In a second aspect, an embodiment of the present application provides a training method for a prediction model for anomaly detection, which is applied to a second device and includes:
[0015] Obtaining historical data of at least one sensor;
[0016] According to the at least one historical data, a preset model using an adaptive weighted smooth loss function is trained to obtain weights for constructing a prediction model, wherein the preset model includes a bidirectional SE module, the weights of the prediction model are the weights of prediction channels of different sensors, and the adaptive weighted smooth loss function is an adaptive smooth loss function with an added regularization term.
[0017] The prediction model is determined according to the weight of the preset model.
[0018] In a possible implementation, the regularization term includes: a regularization parameter and a weight square sum, and the weight square sum includes: a sum of squares of weights corresponding to different sensor prediction channels.
[0019] In a possible implementation, the method further includes:
[0020] Acquire at least one first data detected by a sensor uploaded by a first device, and predicted data corresponding to the at least one first data;
[0021] The prediction model is updated according to the at least one first data and the prediction data corresponding to the at least one first data.
[0022] In a third aspect, an embodiment of the present application provides an abnormality detection device, which is applied to a first device, and the device includes:
[0023] An acquisition module, used for acquiring first data detected by at least one sensor;
[0024] a processing module, configured to input the at least one first data into a pre-acquired prediction model to obtain prediction data corresponding to the at least one first data, wherein the prediction model is a model including a bidirectional SE module acquired from the second device, and the adaptive weighted smoothing loss function in the prediction model is an adaptive smoothing loss function with a regularization term added thereto;
[0025] A determination module is used to determine a target abnormality in the prediction data corresponding to the at least one first data.
[0026] In a possible implementation manner, the determining module is specifically configured to:
[0027] For each type of predicted data corresponding to the first data, when the predicted data is outside a normal value range corresponding to the first data, it is determined that the target abnormal condition is an abnormal condition related to the sensor corresponding to the predicted data.
[0028] In a possible implementation, the device further includes:
[0029] The recording module is used to determine the warning information corresponding to the target abnormal situation and record the prediction data corresponding to the target abnormal situation.
[0030] In a fourth aspect, an embodiment of the present application provides a training device for a prediction model for anomaly detection, which is applied to a second device, and the device includes:
[0031] An acquisition module, used for acquiring historical data of at least one sensor;
[0032] A processing module, configured to train a preset model using an adaptive weighted smooth loss function according to the at least one historical data to obtain weights for constructing a prediction model, wherein the preset model includes a bidirectional SE module, the weights of the prediction model are weights of prediction channels of different sensors, and the adaptive weighted smooth loss function is an adaptive smooth loss function with a regularization term added thereto;
[0033] A determination module is used to determine the prediction model according to the weight of the preset model.
[0034] In a possible implementation, the regularization term includes: a regularization parameter and a weight square sum, and the weight square sum includes: a sum of squares of weights corresponding to different sensor prediction channels.
[0035] In a possible implementation, the acquisition module is further used to: acquire first data detected by at least one sensor uploaded by the first device, and predicted data corresponding to the at least one first data;
[0036] The processing module is further used to update the prediction model according to the at least one first data and the prediction data corresponding to the at least one first data.
[0037] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;
[0038] The memory stores computer-executable instructions;
[0039] The processor executes the computer-executable instructions stored in the memory to implement the method described in the first and second aspects and any one of the above-mentioned methods.
[0040] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods described in the first and second aspects and any one of the methods above.
[0041] In the seventh aspect, an embodiment of the present application provides a computer program, wherein the computer program product includes a computer program, wherein the computer program is stored in a computer-readable storage medium, and at least one processor can read the computer program from the computer-readable storage medium. When the at least one processor executes the computer program, the method described in the first and second aspects and any one of the methods can be implemented.
[0042] The anomaly detection method and the training method of the prediction model for anomaly detection provided by the embodiment of the present application, in the anomaly detection method, firstly, the first data detected by at least one sensor is obtained, and then at least one first data is input into the prediction model obtained in advance to obtain the prediction data corresponding to at least one first data, the prediction model is a model including a bidirectional SE module obtained from the second device, and the adaptive weighted smooth loss function in the prediction model is an adaptive smooth loss function with a regularization term added, and finally the target abnormality is determined in the prediction data corresponding to at least one first data. In this technical solution, the prediction model is used to predict the data collected by the sensor, and then the data abnormality is determined from the prediction data, so as to achieve the technical effect of improving the advance and accuracy of fault warning and reducing the impact of faults on the operation of the server system. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0044] Figure 1 A schematic diagram of the architecture of the anomaly detection method provided in an embodiment of the present application;
[0045] Figure 2 Schematic diagram of the process of the anomaly detection method provided in the embodiment of the present application Figure 1 ;
[0046] Figure 3 Schematic diagram of the process of training a prediction model for anomaly detection provided in an embodiment of the present application Figure 1 ;
[0047] Figure 4 Schematic diagram of the process of training a prediction model for anomaly detection provided in an embodiment of the present application Figure 2 ;
[0048] Figure 5 A schematic diagram of a prediction model for anomaly detection provided in an embodiment of the present application
[0049] Figure 6 Schematic diagram of the process of the anomaly detection method provided in the embodiment of the present application Figure 2 ;
[0050] Figure 7 A schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present application;
[0051] Figure 8 A schematic diagram of the structure of a training device for a prediction model for anomaly detection provided in an embodiment of the present application;
[0052] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.
[0053] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION
[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0055] Before introducing the embodiments of the present application, the application background of the embodiments of the present application is first explained:
[0056] Servers or other devices are usually equipped with various sensors, which are devices or systems used to monitor and manage the server hardware and environmental status. These sensors usually collect data related to server operating status, environmental conditions, and hardware performance to help maintain the stability, performance, and security of the server.
[0057] Among them, temperature sensors are usually installed on important components such as the server's central processing unit (CPU), hard disk, memory bar, and power supply to prevent excessive temperatures from causing server overheating, hardware damage, or performance degradation. Voltage and current sensors are used to detect the input voltage, output voltage, and current value of the server power supply to ensure that the power supply is within the normal working range. If the voltage is too high or too low, it may damage the hardware or cause system instability. Humidity sensors can monitor the humidity of the computer room environment to ensure that it is within the appropriate range to prevent static electricity accumulation, corrosion, and other problems. Fan speed sensors can monitor the fan speed to ensure good air circulation inside the server and keep the hardware temperature within the normal range. If the fan fails or the speed decreases, the risk of system overheating will increase.
[0058] Traditional sensor systems usually use sensors to continuously monitor various parameter data of the environment or equipment in real time, and feed the data back to the server monitoring system or data acquisition system. After the server monitoring system or data acquisition system detects abnormal data collected by the sensor, the system triggers an alarm. The alarm content usually includes the abnormal sensor type, the specific value, the alarm time and other information, and notifies the maintenance personnel through email, SMS, instant messaging, etc. Among them, the alarm is usually triggered after the failure occurs, which may cause potential problems in the system for a long time or even cause more serious damage.
[0059] Therefore, predicting in advance the occurrence of failures in devices or systems used to monitor and manage server hardware and environmental status has become a technical problem that needs to be solved urgently.
[0060] In response to the technical problems existing in the prior art, the inventors of this application have the following technical ideas: the prior art will issue an alarm message after obtaining abnormal sensor data. If the sensor data for a period of time in the future can be predicted based on the regularity of the sensor data collected in real time, it can be determined whether the sensor data for a period of time in the future is abnormal based on the predicted data. Therefore, the sensor data prediction model can be trained based on the historical data of the sensor, the server configures the model, and the collected real-time sensor data is input into the model for prediction. By judging whether the sensor data is abnormal based on the output prediction data, it is possible to predict possible failures of the server in advance. Among them, the algorithm prediction model used in the embodiment of this application is an improved depthwise multiscale and separable convolution net (DMSNet), and the main improvement methods are as follows:
[0061] (1) The unidirectional SE module is replaced by a bidirectional SE module (also known as the Bi-SE module). Through information backflow, the features in the incoming features that are overly sensitive to outliers can be modified, making the model more robust.
[0062] (2) The loss function in the model is replaced with an adaptive weighted smoothing loss function, which can dynamically adjust the threshold (that is, as data samples collected by the same sensor are continuously input into the prediction model, the prediction model will dynamically adjust the weight of each data sample collected by the sensor according to the training process), so that the loss function can better adapt to data within different error ranges, combined with regularization to prevent model overfitting.
[0063] Among them, the threshold is the weight of each data sample collected by the sensor.
[0064] Specifically, Figure 1 A schematic diagram of the architecture of the anomaly detection method provided in the embodiment of the present application, such as Figure 1 As shown, the method involved in the embodiment of the present application is briefly introduced:
[0065] The architecture includes: a cloud database, a target server, a storage device, and sensors 1 to n.
[0066] In a possible implementation, the first device (i.e., the target server) downloads a prediction model applicable to the first device from the second device (i.e., the cloud database) via OTA, and then obtains data information collected by sensors 1 to n. The target server inputs the data information into the prediction model for analysis and prediction to obtain prediction data of different sensor information, and determines sensor abnormality information based on the prediction data. The target server will issue an alarm based on the sensor abnormality information and set the warning light status to abnormal to remind relevant personnel to check and handle it in time.
[0067] In addition, during the operation of the prediction model, the first device will regularly transmit the collected data and prediction data back to the cloud database. The cloud database will continue to train the model in the database based on these returned data, thereby continuously improving the accuracy of the model prediction. The optimized model will be re-downloaded to the target server to ensure the continuous improvement of its prediction performance.
[0068] The second device can also be a storage device. The advantage of the OTA method is that it supports online updates and self-repair of the model. In addition, administrators or model builders can publish models to target servers through the cloud. When publishing a new model or opening an existing model, you can choose which target server to apply the model to. This function implements the allocation of a specific model to a specified target server.
[0069] Wherein, matters not elaborated in detail are disclosed by the following embodiments.
[0070] The technical solution of the present application is described in detail below through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.
[0071] Figure 2 Schematic diagram of the process of the anomaly detection method provided in the embodiment of the present application Figure 1 ,like Figure 2 As shown, the method is applied to the first device and may include the following steps:
[0072] Step 21, obtaining first data detected by at least one sensor;
[0073] In this step, the sensor collects data information, and the first device obtains at least one type of sensor data information.
[0074] The type of sensor may be a temperature sensor, a pressure sensor, a voltage sensor, a power consumption sensor, etc. The first data is data collected by the sensor within a period of time.
[0075] In a possible implementation, the first device is a server.
[0076] Step 22: inputting at least one first data into a pre-acquired prediction model to obtain prediction data corresponding to the at least one first data;
[0077] The prediction model is a model obtained from the second device and includes a bidirectional SE module, and the adaptive weighted smooth loss function in the prediction model is an adaptive smooth loss function with a regularization term added.
[0078] In this step, after the first device acquires the sensor data, the acquired sensor data is input into a pre-trained prediction model, and the prediction model analyzes and predicts the sensor data to obtain predicted data.
[0079] The prediction model is an algorithm model used for sensor data prediction. The prediction model can also be obtained after training an algorithm model such as an autoregressive integrated moving average model, a long short-term memory network model, or a random forest model.
[0080] It is worth noting that the prediction model can be replaced. For example, after the model is updated, the first device can replace the old model with the latest model. The latest prediction model weight can be adopted by using the latest model, thereby further improving the prediction accuracy of sensor data.
[0081] Step 23: Determine a target abnormality in the prediction data corresponding to at least one first data.
[0082] In this step, the prediction model determines abnormal data in the prediction data obtained based on the current data of the sensor, and then determines the target abnormal situation of the corresponding sensor based on the source sensor of the abnormal data.
[0083] In one possible implementation, the prediction model obtains prediction data based on the current data of the sensor. The prediction model determines that the prediction data comes from the temperature sensor, and then determines the abnormality of the temperature sensor based on the prediction data. The target abnormality is that the temperature sensor data will exceed the normal value range of 0° to 100° after 5 minutes, and the predicted data is 105°.
[0084] Optionally, step 23 may include the following implementation:
[0085] For each type of predicted data corresponding to the first data, when the predicted data is outside the normal value range corresponding to the first data, it is determined that the target abnormal condition is an abnormal condition related to the sensor corresponding to the predicted data.
[0086] In this implementation, for the predicted data corresponding to each type of sensor data, the prediction model combines the normal numerical range of the pre-trained sensor data to determine whether the predicted data is within the normal numerical range. If the predicted data is not within the normal numerical range, the prediction model uses the abnormal situation of the sensor corresponding to the predicted data that is not within the normal numerical range as the target abnormal situation.
[0087] In one possible implementation, the prediction model determines that the normal value range of the temperature sensor data is 0° to 100° based on the historical data obtained by the temperature sensor. The prediction model obtains the predicted data of 105° 5 minutes later based on the current data of the temperature sensor obtained by the first device. The prediction model determines that the abnormal condition of the temperature sensor is the target abnormal condition.
[0088] Optionally, step 23 may also include the following implementation:
[0089] Determine the warning information corresponding to the target abnormal situation and record the prediction data corresponding to the target abnormal situation.
[0090] In this implementation, the first device determines corresponding warning information according to the target abnormal situation, and records the predicted data of the sensor data corresponding to the target abnormal situation for a period of time in the future in a log file.
[0091] In a possible implementation, the data abnormality of the temperature sensor is a target abnormality, and the first device determines warning information based on the abnormality of the sensor data, and then records the predicted data of the temperature sensor within 10 minutes (including data within a normal range and abnormal data).
[0092] The warning information may be an indication of turning on a warning light.
[0093] For example, if the predicted data is abnormal, the first device turns on the warning light according to the warning information and sends the obtained warning information to the administrator. The administrator troubleshoots and repairs the first device corresponding to the abnormal situation. After the fault is repaired, the warning light is turned off.
[0094] The abnormality detection method provided in the embodiment of the present application first obtains the first data detected by at least one sensor, and then inputs the at least one first data into a pre-acquired prediction model to obtain the prediction data corresponding to the at least one first data. The prediction model is a model including a bidirectional SE module obtained from the second device. The adaptive weighted smooth loss function in the prediction model is an adaptive smooth loss function with a regularization term added. Finally, the target abnormality is determined in the prediction data corresponding to the at least one first data. In this technical solution, the prediction model is used to predict the data collected by the sensor, and then the data abnormality is determined from the prediction data, which achieves the technical effect of improving the advance and accuracy of fault warning and reducing the impact of faults on the operation of the server system.
[0095] Based on the above embodiments, Figure 3 Schematic diagram of the process of training a prediction model for anomaly detection provided in an embodiment of the present application Figure 1 ,like Figure 3 As shown, the method is applied to a second device, comprising:
[0096] Step 31, obtaining historical data of at least one sensor;
[0097] In this step, the second device obtains historical data collected by various sensors.
[0098] The historical data refers to the data collected by the sensor before the current moment.
[0099] Step 32: training a preset model using an adaptive weighted smoothing loss function based on at least one historical data to obtain a weight for constructing a prediction model;
[0100] The preset model includes a bidirectional SE module, and the weight of the prediction model is the weight of the prediction channel of different sensors (in the formula of the following adaptive weighted smoothing loss function, ), the adaptive weighted smooth loss function is an adaptive smooth loss function with a regularization term added. In this step, the second device trains the prediction model based on the acquired historical sensor data to obtain the algorithm weights of different sensor prediction channels, which are used to predict the data trend of the newly acquired at least one sensor in the future.
[0101] Among them, the adaptive smoothing loss function in the prior art is shown in the following formula:
[0102]
[0103] In the formula, is the true value of the i-th sample, is the predicted value of the ith sample, is the sample standard deviation.
[0104] In the embodiment of the present application, the formula of the adaptive weighted smoothing loss function is as follows:
[0105]
[0106] Where n is the number of samples, is the weight of the i-th sample, is the true value of the i-th sample, is the predicted value of the ith sample, is the standard deviation of the ith sample, is the regularization parameter, Predict the weight of the channel for the jth sensor.
[0107] Among them, the number of n samples is n sensor data collected by the same sensor. Taking the temperature sensor as an example, the true value of the i-th sample is the i-th temperature data in the first data obtained by the temperature sensor, and the predicted value of the i-th sample is obtained based on the prediction of the true value of the i-th sample.
[0108] Specifically, the adaptive smoothing loss function uses a fixed threshold (i.e. ), while the adaptive weighted smoothing loss function uses a dynamically adjusted threshold (i.e. ), which makes the loss function better adaptable to sensor data within different error ranges. The adaptive weighted smoothing loss function introduces weights to the sensor data (i.e. ), to reflect the importance of different sensor data. This allows the loss to be adjusted according to the importance of samples or features, thereby improving the performance of the model. Adding regularization terms , to prevent the model from overfitting. This is not available in the adaptive smooth loss function.
[0109] Step 33: Determine the prediction model according to the weight of the preset model.
[0110] In this step, a prediction model that can be used to predict the trend of sensor data is determined based on the model weights obtained from the prediction model training, so that the prediction model can be configured in the server to predict the newly collected sensor data.
[0111] Optionally, the regularization term includes: a regularization parameter and a weight square sum, and the weight square sum includes: a sum of squares of weights corresponding to different sensor prediction channels.
[0112] The training method of the prediction model for anomaly detection provided in the embodiment of the present application obtains historical data of at least one sensor, and then trains a preset model using an adaptive weighted smooth loss function based on at least one historical data to obtain weights for constructing the prediction model, and finally determines the prediction model based on the weights of the preset model. In this technical solution, the prediction model is trained on the historical data of the sensor to obtain the prediction model, so that the prediction model has accurate prediction capabilities, which facilitates the subsequent accurate and efficient acquisition of the prediction data of the sensor in the future.
[0113] Based on the above embodiments, Figure 4 Schematic diagram of the process of training a prediction model for anomaly detection provided in an embodiment of the present application Figure 2 ,like Figure 4 As shown, the method is applied to a second device, comprising:
[0114] Step 41: Acquire first data detected by at least one sensor uploaded by a first device, and predicted data corresponding to the at least one first data;
[0115] In this step, the second device obtains the sensor detection data uploaded by the first device, and then obtains the prediction data of the corresponding sensor obtained by inputting the sensor collection data into the prediction model.
[0116] Step 42: Update the prediction model according to at least one first data and at least one prediction data corresponding to the first data.
[0117] In this step, according to the sensor collection data and the corresponding prediction data are input into the prediction model for training, the prediction model can update the algorithm weight according to the newly input collection data and prediction data, and update the prediction model at the same time.
[0118] The training method of the prediction model for anomaly detection provided in the embodiment of the present application obtains the first data detected by at least one sensor uploaded by the first device, and the prediction data corresponding to at least one first data, and then updates the prediction model according to the at least one first data and the prediction data corresponding to at least one first data. The technical solution updates the prediction model according to the sensor collected data and the prediction data, thereby achieving the technical effect of continuously improving the accuracy of the model prediction and ensuring the continuous improvement of the server system performance.
[0119] Figure 5 A schematic diagram of the structure of the prediction model for anomaly detection provided in the embodiment of the present application, combined with Figure 5 The prediction model is introduced in detail:
[0120] (1) The prediction model preprocesses at least one sensor data obtained and inputs it into the model;
[0121] Among them, data preprocessing includes eliminating invalid data collected by sensors and processing valid sensor data into a format recognizable by the prediction model.
[0122] In a possible implementation, the sensor data is processed into a two-dimensional matrix that can be recognized by the prediction model.
[0123] (2) Use convolution operations to extract features from the input information and reduce the dimension;
[0124] In this implementation, local features can be effectively extracted and dimension reduction can be performed by using the local receptive field. The convolution operation itself reduces the spatial dimensions (width and height) of the input data, but by properly designing the convolution kernel and pooling layer, valuable information can be retained.
[0125] (3) The features obtained from the convolution process are passed to the Adaptive Multi-Scale Residual Block (AMSRB) for feature extraction;
[0126] In this implementation, the features passed into the convolution layer are processed by fusing the depthwise separable convolution module, the multi-scale convolution module and the bidirectional SE module (also known as the Bi-SE module) in AMSRB, which can effectively improve the feature extraction capability and computational efficiency of the model.
[0127] Specifically, compared with the unidirectional SE module, the Bi-SE module can modify the features that are overly sensitive to outliers in the incoming features through information reflux (the dotted part of the Bi-SE module in the figure), making the model more robust.
[0128] In one possible implementation, the feature extraction capability and computational efficiency of the Bi-SE module are improved by 7% compared to the unidirectional SE module.
[0129] (4) The obtained features are then passed into the bidirectional long short-term memory network (BiLSTM) and the multi-head attention mechanism module to capture the contextual relationship in the process of parallel calculation, making the model faster in capturing the relationship between data in large-scale data;
[0130] Among them, BiLSTM can better capture the contextual relationship in time series data by considering both the forward and reverse information of the input sequence. This is particularly effective for processing sensor data with time series because it can combine past and future contextual information. The multi-head attention mechanism calculates multiple different attention heads in parallel, and the model can capture the contextual relationship of different parts from multiple perspectives.
[0131] (5) Output predicted values based on features;
[0132] In one possible implementation, Figure 6 Schematic diagram of the process of the anomaly detection method provided in the embodiment of the present application Figure 2 , combined with Figure 6 A detailed introduction to the implementation:
[0133] Step 1. Get started.
[0134] Step 2: Set the warning light status to normal.
[0135] Step 3: Sensor data collection.
[0136] Step 4: Data preprocessing.
[0137] Step 5: Input to the prediction model.
[0138] Step 6: Get the algorithm-predicted sensor data.
[0139] Step 7: Predict whether the data is abnormal.
[0140] If there is an exception, execute step 8, and if there is no exception, execute step 9.
[0141] Step 8. Record the predicted data in the log.
[0142] The prediction model will automatically write the prediction data into the log. Each log will be recorded in a file named prediction_log.txt (also known as the log file), and then step 2 will be executed.
[0143] Step 9. Set the warning light status to abnormal.
[0144] Among them, after executing step 9, execute step 10, and then execute step 11.
[0145] Step 10. Record the prediction data in the log.
[0146] Among them, step 3 is executed after recording the predicted data in the log.
[0147] Step 11: Send warning information to the administrator.
[0148] Step 12: Troubleshooting and repair.
[0149] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.
[0150] Figure 7 This is a schematic diagram of the structure of the abnormality detection device provided in the embodiment of the present application. Figure 7 As shown, the device is applied to a first device, comprising:
[0151] An acquisition module 71 is used to acquire first data detected by at least one sensor;
[0152] A processing module 72, configured to input the at least one first data into a pre-acquired prediction model to obtain prediction data corresponding to the at least one first data, wherein the prediction model is a model including a bidirectional SE module acquired from the second device, and the adaptive weighted smoothing loss function in the prediction model is an adaptive smoothing loss function with a regularization term added thereto;
[0153] The determination module 73 is used to determine a target abnormality in the prediction data corresponding to the at least one first data.
[0154] In a possible implementation manner, the determination module 73 is specifically configured to:
[0155] For each type of predicted data corresponding to the first data, when the predicted data is outside a normal value range corresponding to the first data, it is determined that the target abnormal condition is an abnormal condition related to the sensor corresponding to the predicted data.
[0156] In a possible implementation, the device further includes:
[0157] The recording module is used to determine the warning information corresponding to the target abnormal situation and record the prediction data corresponding to the target abnormal situation.
[0158] Figure 8 A schematic diagram of the structure of a training device for a prediction model for anomaly detection provided in an embodiment of the present application, such as Figure 8 As shown, the device is applied to a second device, comprising:
[0159] An acquisition module 81, used to acquire historical data of at least one sensor;
[0160] A processing module 82 is used to train a preset model using an adaptive weighted smooth loss function according to the at least one historical data to obtain weights for constructing a prediction model, wherein the preset model includes a bidirectional SE module, the weights of the prediction model are weights of prediction channels of different sensors, and the adaptive weighted smooth loss function is an adaptive smooth loss function with a regularization term added thereto;
[0161] The determination module 83 is used to determine the prediction model according to the weight of the preset model.
[0162] In a possible implementation, the regularization term includes: a regularization parameter and a weight square sum, and the weight square sum includes: a sum of squares of weights corresponding to different sensor prediction channels.
[0163] In a possible implementation, the acquisition module 81 is further used to: acquire first data detected by at least one sensor uploaded by the first device, and predicted data corresponding to the at least one first data;
[0164] The processing module 82 is further configured to update the prediction model according to at least one first data and the prediction data corresponding to the at least one first data.
[0165] The device provided in the embodiments of the present application can be used to execute the determination method in any of the above embodiments. Its implementation principle and technical effects are similar and will not be repeated here.
[0166] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software calling through processing elements, and some modules can be implemented in the form of hardware. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.
[0167] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Fig. 9 As shown, the electronic device may be the first device or the second device mentioned above.
[0168] The method comprises: a processor 91, a memory 92, and computer program instructions stored in the memory 92 and executable on the processor 91, wherein the processor 91 implements the method provided in any of the above-mentioned embodiments when executing the computer program instructions.
[0169] Optionally, the above-mentioned components of the electronic device may be connected via a system bus.
[0170] The memory 92 may be a separate storage unit or a storage unit integrated in the processor 91. The number of the processor 91 may be one or more.
[0171] It should be understood that the processor 91 may be a central processing unit (CPU), or other general-purpose processors 91, digital signal processors 91 (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor 91 may be a microprocessor 91 or the processor 91 may be any conventional processor 91, etc. The steps of the method disclosed in the present application may be directly embodied as being executed by the hardware processor 91, or may be executed by a combination of hardware and software modules in the processor 91.
[0172] The system bus may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The memory 92 may include a random access memory 92 (RAM), and may also include a non-volatile memory 92 (NVM), such as at least one disk memory 92.
[0173] All or part of the steps of the above-mentioned method embodiments can be completed by hardware related to program instructions. The above-mentioned program can be stored in a readable memory 92. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the above-mentioned memory 92 (storage medium) includes: read-only memory 92 (ROM), RAM, flash memory 92, hard disk, solid state hard disk, magnetic tape, floppy disk, optical disc and any combination thereof.
[0174] The electronic device provided in the embodiment of the present application can be used to execute the method provided in any of the above method embodiments. Its implementation principles and technical effects are similar and will not be repeated here.
[0175] An embodiment of the present application provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the above method.
[0176] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.
[0177] Optionally, a readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.
[0178] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.
Claims
1. An anomaly detection method, characterized in that: Applied to a first device, the method includes: Acquire first data detected by at least one sensor; Inputting the at least one first data into a pre-acquired prediction model to obtain prediction data corresponding to the at least one first data, wherein the prediction model is a model including a bidirectional SE module acquired from the second device, and the adaptive weighted smoothing loss function in the prediction model is an adaptive smoothing loss function with a regularization term added thereto; A target abnormality is determined in the prediction data corresponding to the at least one first data.
2. The method according to claim 1, characterized in that: The determining of a target abnormality in the prediction data corresponding to the at least one first data includes: For each type of predicted data corresponding to the first data, when the predicted data is outside a normal value range corresponding to the first data, it is determined that the target abnormal condition is an abnormal condition related to the sensor corresponding to the predicted data.
3. The method according to claim 2, characterized in that The method further comprises: Determine the warning information corresponding to the target abnormal situation, and record the prediction data corresponding to the target abnormal situation.
4. A method for training a prediction model for anomaly detection, characterized in that: Applied to the second device, the method includes: Obtaining historical data of at least one sensor; According to the at least one historical data, a preset model using an adaptive weighted smooth loss function is trained to obtain weights for constructing a prediction model, wherein the preset model includes a bidirectional SE module, the weights of the prediction model are weights of prediction channels of different sensors, and the adaptive weighted smooth loss function is an adaptive smooth loss function with a regularization term added thereto; The prediction model is determined according to the weight of the preset model.
5. The method according to claim 4, characterized in that The regularization term includes: a regularization parameter and a weighted sum of squares, and the weighted sum of squares includes: a sum of squares of weights corresponding to different sensor prediction channels.
6. The method according to claim 4 or 5, characterized in that: The method further comprises: Acquire at least one first data detected by a sensor uploaded by a first device, and predicted data corresponding to the at least one first data; The prediction model is updated according to the at least one first data and the prediction data corresponding to the at least one first data.
7. An abnormality detection device, characterized in that: Applied to a first device, the apparatus comprises: An acquisition module, used for acquiring first data detected by at least one sensor; a processing module, configured to input the at least one first data into a pre-acquired prediction model to obtain prediction data corresponding to the at least one first data, wherein the prediction model is a model including a bidirectional SE module acquired from the second device, and the adaptive weighted smoothing loss function in the prediction model is an adaptive smoothing loss function with a regularization term added thereto; A determination module is used to determine a target abnormality in the prediction data corresponding to the at least one first data.
8. A training device for a prediction model for anomaly detection, characterized in that: Applied to a second device, the apparatus comprises: An acquisition module, used for acquiring historical data of at least one sensor; A processing module, configured to train a preset model using an adaptive weighted smooth loss function according to the at least one historical data to obtain weights for constructing a prediction model, wherein the preset model includes a bidirectional SE module, the weights of the prediction model are weights of prediction channels of different sensors, and the adaptive weighted smooth loss function is an adaptive smooth loss function with a regularization term added thereto; A determination module is used to determine the prediction model according to the weight of the preset model.
9. An electronic device, characterized in that: include: A processor and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.